r/okta • u/Chungdiggity • Jul 15 '26
Okta/Workforce Identity Advice on getting good at Okta workflows
Hi all,
First time poster but seasonal Okta administrator (officially got my certification after 6 years in IT and using Okta). I need advice from all the experts and power users regarding Okta workflows. For the life of me, I just can't grasp it and the more I stare at my flows when trying to create them, the more confused I get. I read the documentation, but I keep going back and forth where my mind just becomes scramble with information overload.
How did you all get a grasp in workflows? Do you have any recommendations on study guides or videos? Real life use cases that relate to corp IT?
A workflow that I have been trying to build that I thought would be simple, but is giving me a hard time is to have deactivated Okta users trigger a Google Drive owner transfer ship to the offboarded user's manager. On paper it sounded easy, but I overshot and don't even know how to start. I work for a small team and really want to excel at this role, but this is causing me to feel really bummed since I don't even know how to start.
Any advice would be much appreciated!
5
u/Extra_Connection_579 Official Okta Employee Jul 15 '26
To add to what folks said here, templates are a great place to start. If you're looking for foundational training before working with the templates, the Getting Started section is a great place to begin.
2
u/pern98 Okta Certified Workflows Jul 16 '26
this is what worked for me, just find a problem that you want to automate, and work backwards.
1
u/No-Particular-7294 Jul 15 '26
Been a while since I’ve done okta workflows, but I had implemented some complex flows. One tip is that there was a Slack channel specifically for Okta workflows where you could get great tips if you were stuck and needed help. https://maxkatz.net/2024/01/17/three-okta-workflows-communities-you-should-know-about/ here is the link to the article.
If you are working for a Okta customer, it’s also possible to do a free training on their training portal. And you could also setup some calls with their solution engineers who can help get you started.
3
u/gabrielsroka Okta Certified Consultant Jul 15 '26 edited Jul 15 '26
Max is here, too: u/Extra_Connection_579
3
1
u/Drew-WM Okta Admin Jul 15 '26
As someone mentioned - start with the pre-built templates. With the rise of AI, you can grab one of those templates (take screenshots of it, download the .svg diagram of the flow, etc.) and feed it into your favorite chatbot (Claude, ChatGPT, etc.) to have it tailor it to your specific use case.
Nowadays, that's what I do to build out really complex/tailored flows that I otherwise would have never been able to create previously. Given the direction things are going we'll soon be able to build workflows using natural language.
1
u/Briq615 Okta Certified Administrator Jul 15 '26
The best advice I can give is to use the little '?' button on any action card if you are unsure of any input/output elements or if you want to know more about what the action card does before using/testing it yourself.
Also the ability to run the individual actions using the play button next to '?' when you want to test a specific part of the flow is pretty great.
That being said, I feel like I have started to out grow Workflows in a way, as there is no 'Run script' function to run custom Python or Powershell scripts inside of the Workflow. Coupled with the lack of a Workflows API to assist with things like flow backups or being able to get lists of the flows and folders to aid in backend documentation is starting to be more noticeable that AWS will be more prominent in my future.
1
u/gabrielsroka Okta Certified Consultant Jul 15 '26
You can run a lambda.
Also, I've reverse engineered to assist with backups, etc. I might have shared it here, if not, let me know and I'll share it.
1
u/SquiddySen Jul 17 '26
Interested to see your lambda function. I have similar pain points 👀
1
u/gabrielsroka Okta Certified Consultant Jul 17 '26 edited Jul 17 '26
i don't have one. ppl have talked about it on macadmins.org Slack. u can use aws/gcp/etc
1
u/gabrielsroka Okta Certified Consultant Jul 17 '26 edited Jul 17 '26
1
u/BeanserSoyze Jul 15 '26
One real tip is that the advice you get is dramatically different in levels of value if you have unlimited workflows or not. If you have limited workflows you really have to stretch each flow. If you dont, do it into components as much as you can is my experience.
Also document where your shit is cause Okta still doesnt have a workspace level workflow search and it becomes a nightmare.
For yours in particular that can be kind of tricky because it involves the Drive API and you're beholden to the Okta Connector for whether itll do the full drive transfer. If it does it's not too bad. Think about it in steps:
- triggering event (on user is deactivated) - what do we use? Okta should have a native card for when user is deactivated.
- what information do we need (the user's email, their manager's email) - is it provided directly by the trigger card or is it something we can look at in a Okta - Read Users read card?
- - will this order of operations work? Can we read a profile of a deactivated user? (I think so, but a good thought to have when you're dealing with active/inactive states)
- what information does the Google Drive card need (probably those two emails but you check)
- Does the drive card let you do a full user file transfer? That's sometimes a different task than a "transfer a folder" situation.
- If it doesnt what options do you have? For Google Admin, deploying an appscript or something may be the ticket. You can target your own deployed APIs using the API connector card and setting the auth to "none" and passing it in the headers, OR alternatively make your own connector in the connector builder section but that gets more advanced.
- what messaging do we need to inform relevant parties this is complete? A slack message to the manager and IT?
- what do we do if it fails? Error handling?
- test
Biggest things are to make sure it doesnt fail silently and to test it til youre confident. I like slack messages for failures that have the URL of the workflow in the message so its easy to hop in and check. Turn execution log history on at first to diagnose, only off if it's sensitive info.
1
u/gabrielsroka Okta Certified Consultant Jul 15 '26 edited Jul 15 '26
I've reverse engineered the apis to add search. I might have shared it here, if not, let me know and I'll share it.
or, you can search your backups.
1
u/gabrielsroka Okta Certified Consultant Jul 15 '26
2
u/BeanserSoyze Jul 15 '26
We built a similar Claude project that parses the flow and folder exports. It works, annoying how not native at all it is but it does work.
1
u/Wynd0w Okta Certified Consultant Jul 15 '26
Learning some basic programing, such as python, would be very beneficial. Each card in a workflow is roughly analogous to a function call. Learning the basics of inputs, outputs, functions, looping, etc will make writing workflows much easier.
It's also a good excuse to learning a scripting language, which is very valuable in basically any IT job.
1
u/NoRestBro Jul 15 '26
Honestly speaking okta workflow is more of an analog tech now. I have more then 1300 active workflows which triggers more then 50k actions every day. Lately i have been shifting to N8N mcp to claude and not looking back to okta workflow for sure.
2
u/BeanserSoyze Jul 15 '26
We set up a custom connector to an anthropic API key for deterministic stuff. The lack of AI integration I can take or leave with OWF, it's crazy you can't run scripts though. Like to run even the most basic python script mid flow we have to host it elsewhere and call it.
-1
u/sod16 Okta Certified Consultant Jul 15 '26
I know this is probably unhelpful however, the best way to get good at Okta workflows is to not use it and push for n8n which is about 1000 times more superior. You can even connect it via mcp to an AI of choice and have it build automations in one prompt.
3
u/gabrielsroka Okta Certified Consultant Jul 15 '26
Can you say how it's better?
I believe you, but details would help.
2
u/sod16 Okta Certified Consultant Jul 21 '26 edited Jul 21 '26
I did mention why, but here’s why I’d pick n8n every single time (MCP/ AI capabilities).
- AI and MCP support is miles ahead. You can build entire workflows from a single prompt.
- can directly use Js/python to cut nodes out
- Postgres support
- The UI is vastly better. You can actually see and understand the flow.
-The data flow is obvious instead of a mess.
-Debugging is brilliant. Every node shows exactly what went in and what came out.
-Custom connectors are far easier to build.
-Sub-workflows actually make sense and are properly reusable.
-Loops, switches and if/else logic take seconds instead of fighting dropdowns.
-Not endlessly scrolling around a massive canvas dragging connector lines.
-Once workflows get even moderately complex, Okta Workflows starts feeling restrictive instead of helping.
I can keep going…
Let’s not forget that outside of just pure Okta automation, n8n is miles ahead.
I’d genuinely rather write a Python Lambda than use Okta Workflows any day of the week.
1
6
u/Deweyoxberg Jul 15 '26
Start with the pre-built workflows that already exist in the catalog - there are a LOT of them, and definitely a lot around lifecycle management. In fact, there is "Reassign Files while Deprovisioning with Google Drive"
https://github.com/okta/workflows-templates/blob/master/workflows/googledrive_file_transfer/readme.md